Geopolitical risk and corporate security advisory

Ilkay Sarpdag: Stewardship teams will ask which committee owns it, how often it is on the agenda, and whether the annual report’s principal risk disclosures match what management says in meetings. Inconsistency between the two is the most common trigger for a governance downgrade. In our view:

1. Assign ownership at full Board level, with the risk committee holding the detailed review and reporting up each quarter. Investors read a security topic buried in an operating committee as a sign the Board does not consider it strategic.
2. Yes, threats differ materially by country, and the Board should say so. Sanctions and export control exposure sit in one set of jurisdictions, expropriation and capital control risk in another, personnel and physical security in a third, cyber and data localisation across all of them. A single global heat map hides more than it shows; a jurisdiction-by-jurisdiction map with a rating per threat type can be part of the update to investors, at least in summary, in the principal risks section in the annual report.
3. Name a senior accountable executive (often the general counsel or chief risk officer, with the chief security officer reporting through them) and give the Board direct access to that person, at least twice a year without the CEO in the room.

Mike Davies: In general, the most useful frameworks are those that aid Board decision-making, rather than those that catalogue every geopolitical and security risk across every jurisdiction, asset, person and supply chain node. This means that the framework should be linked to the decisions the Board has to make whether market entry and exit, capital allocation or resource requirements. It also means that the framework should be anchored to the Board's existing risk appetite statement, rather than building a parallel geopolitical risk taxonomy alongside it.

The framework should be built on four inputs. These are:

•  an exposure map, which provides an inventory across jurisdictions, assets, people, supply chain nodes, joint ventures;

• A threat and vulnerability assessment, which considers the likelihood and speed that different threat types (eg sanctions and export control, expropriation and capital control, personnel and physical security, cyber and data localisation, regulatory interventions) may materialise;

• An impact and materiality score for different factors such as financial, operational, legal and reputational; and

• Prioritisation and appetite map which, in alignment with the Board’s risk appetite statement, reflects which risks to accept, mitigate, transfer or avoid.

Ilkay Sarpdag: The investor question is always the same, what is the loss given event, and is it already reflected in guidance? A Board that can answer with a number, a legal position and a timeline keeps the multiple. A Board that says ‘’we are monitoring the situation’’ invites a derating and, later, a claim that risk factors were inadequate. Start by closing response gaps with the following:

1. Approve a risk action playbook in advance. For each jurisdiction where business operations exist, outline what the company would do within 24 hours, 7 days and 30 days of sanctions, an export control designation, a licence revocation, a capital control or a seizure of assets. The Board should identify and approve thresholds and the sequence and not the individual decisions on the night.
2. Keep the legal architecture ready and updated regularly, for example ownership structures, investment treaty protections, arbitration clauses, political risk insurance, and the ability to ring fence or exit an entity quickly in jurisdictions, where geopolitical risks are medium to high on the scale.
3. Plan the disclosure alongside the response. A government action against a company can be constituted as inside information. UK MAR or a Form 8-K trigger under US rules for the company to inform the market. The playbook must state who decides on an announcement, within what time frame, how the Board is consulted.

Keith Morrow: Given that action may be required without delay following a geopolitical event, management and the Board should have clearly defined responsibilities and understand how the response will operate. For companies engaged in international trade or with foreign investment, best practice is to have a policy and procedure setting out the response to a material geopolitical event.

The Board, normally through the Chair, should be notified when management activates the response. Management should then lead the operational response, providing the Board with regular updates on material actions and seeking approval for financial or legal commitments above agreed management authority limits.

The Board should be informed of any regulatory engagement and consulted on significant external communications. Any resulting material strategic change should require Board approval, such as exiting a market, disposing of a material asset or changing the company’s risk appetite.

The policy should distinguish between decisions required to address an immediate threat and those that could materially affect strategy, risk appetite, financial position or reputation.

Finally, the policy should specify management’s authority where the Board cannot be contacted. In an extreme situation involving material risk to people, assets or business continuity, management should act immediately within defined parameters and report actions taken to the Board as soon as practicable.

Mike Davies: There isn’t a single correct approach, but, in general, Boards should expect management to have either in-house or external political and security risk advisors, probably both. There should be a mix of skills and expertise depending on the sector and geographies involved – generic country-risk commentary or current event news analysis will not be sufficient to identify critical geopolitical and corporate security threats in advance. In-country sources with local language knowledge will also be important to ensure quality information flows.

These teams should provide structured threat assessments that correspond to the relevant risk rating for each country or specific asset. The assessments should include forward-looking indicators such as shifts in political rhetoric and social unrest factors and use consistent metrics so that trends over time are visible. The reporting cycle should be regular with ad hoc real-time alerts for material developments. Boards should periodically test the credibility of response by, for example, reviewing whether a material event was flagged sufficiently in advance.

Boards should also be cautious of relying solely on intelligence or reporting received from the local business unit or country management, who might downplay risks to their operations. A direct reporting channel that bypasses filtering by operational managements, is also critical for Boards to verify the accuracy of information. Similarly, a whistleblowing channel should also be established for when normal channels breakdown.

Mike Davies: Assurance should focus on stress testing, rather than relying on documentation review. There should be a minimum standard for business continuity, crisis management and evacuation planning across all jurisdictions, but the specific details of evacuation routes, medical support and communication protocols, will need to reflect local conditions. Local knowledge is critical in getting this right. It can’t rely on a centrally written template, that has not been subjected to conditions on the ground.

Duty-of-care obligations also differ by country and by employment status and need to reflect local requirements. Travel tracking, medical evacuation insurance and emergency communication capability must be accessible and operational. Regular testing and audits against recognised standards will help with assurance here too.

Keith Morrow: Over the past five years, geopolitical risk has moved into the leading group of risks identified in the World Economic Forum’s Global Risks Report. As a result, geopolitical considerations have evolved from being primarily relevant to procurement and foreign compliance decisions, to becoming an important component of broader business and strategic risk management.

Geopolitical risk can create exposures across a range of areas, including supply chains, ownership structures, regulation, markets, logistics, investment and third-party relationships. With more than ten potential exposure areas to consider, this can represent a significant volume of information for a Board. To make this both digestible and actionable, the Board’s focus should be on material exposures, prioritised through the organisation’s corporate risk framework and risk matrix.

Third parties—including suppliers, partners, agents, joint ventures and other commercial relationships—can create or increase these exposures. Geopolitical risk should therefore form part of the management of significant third-party relationships and be considered when major commercial or strategic decisions are being made.

Where the Board is asked to approve a significant commercial decision involving activity in a foreign country, it should expect management to provide a clear assessment of the relevant geopolitical risks. This should allow the Board to consider geopolitical exposure alongside the commercial case, and make a more balanced and informed decision.

A current example is the impact of regional conflict on global logistics. The diversion of shipping routes around southern Africa has increased transit distances and costs for some Asia–Europe trade routes, demonstrating how geopolitical events can have a direct and material impact on margins, working capital, customer service and supply chain resilience.

Ilkay Sarpdag: Fit for purpose, from the investor’s side of the table, means three things. The Board can describe the model without notes. The model has been tested and the results were reported. The disclosure matches the reality a stewardship team hears in engagement. Investors judge risk oversight after the fact, by whether the Board looked prepared before it.

For further reading, do download the white paper ‘Steering Boards Through Geopolitical Turbulence’ co-authored by nine GAA practitioners: www.globaladvisoryalliance.com